apple-tools-mcp 2.1.0 → 2.1.2

package/README.md

@@ -77,7 +77,7 @@ Write tools drive Mail, Messages, Calendar, and Contacts through AppleScript. ma
 
 #### First install and upgrade: `apple-tools-mcp permissions`
 
-Run this **after first global install** and **after upgrade** when write surfaces are present or change. It probes **`process.execPath`** (the `node` running the command) so macOS can pop **Allow** dialogs for Contacts, Calendar, Mail, and Messages in one sitting. You click **Allow**; the command cannot grant silently. Already-granted surfaces report OK without another click. Missing grants print a report and the process **exits non-zero** (fail closed).
+Run this **after first global install** and **after upgrade** when write surfaces are present or change. It probes **`process.execPath`** (the `node` running the command) so macOS can pop **Allow** dialogs for Contacts, Calendar, Mail, Messages, and System Events in one sitting. You click **Allow**; the command cannot grant silently. Already-granted surfaces report OK without another click. Missing grants print a report and the process **exits non-zero** (fail closed).
 
 Use the **same `node` the product uses** — not the MCP host app. Always invoke so **`process.execPath`** is that node. A bare `apple-tools-mcp` (or a path like `~/.nvm/versions/node/v22.21.1/bin/apple-tools-mcp`) can have a shebang that starts a **different** node; Allow dialogs attach to `execPath`, not the CLI path you typed.
 
@@ -98,15 +98,15 @@ If the invoked CLI path and `process.execPath` differ, the command prints a **WA
 - **Mini:** `/Users/petercoates/.local/node/bin/node` (global npm / indexer LaunchAgent)
 - **MacBook:** `/Users/petercoates/.nvm/versions/node/v22.21.1/bin/node` (Claude’s nvm `node`, **not** Homebrew)
 
-**MacBook (default for `permissions`):** run from **Terminal.app**. Click **Allow** for the **printed `process.execPath`**. Confirm **System Settings → Privacy & Security → Automation** for that node → Contacts, Calendar, Mail, and Messages. Do **not** start `apple-tools-indexer` — the always-on indexer / write bridge is a **Mini** install only.
+**MacBook (default for `permissions`):** run from **Terminal.app**. Click **Allow** for the **printed `process.execPath`**. Confirm **System Settings → Privacy & Security → Automation** for that node → Contacts, Calendar, Mail, Messages, and System Events. Do **not** start `apple-tools-indexer` — the always-on indexer / write bridge is a **Mini** install only.
 
 **Mini:** use the [Mini ship-gate](#mini-ship-gate-host-setup) path (LaunchAgent-owned node / `writer.sock`). Missing-grant copy mentions the write bridge only when that socket is present.
 
-On the host UI (Mini Screen Sharing or MacBook local), open **System Settings → Privacy & Security → Automation**, then run the command. Click **Allow** for **`node`** → Contacts, Calendar, Mail, and Messages. npm `postinstall` only **prints a reminder** — it does not run the probes unattended.
+On the host UI (Mini Screen Sharing or MacBook local), open **System Settings → Privacy & Security → Automation**, then run the command. Click **Allow** for **`node`** → Contacts, Calendar, Mail, Messages, and System Events. npm `postinstall` only **prints a reminder** — it does not run the probes unattended.
 
-This is a real Apple Events pass: Mail uses `make new outgoing message` (compose then discard; nothing is sent). Messages enumerates accounts (nothing is sent). `dry_run` of `mail_send` / `messages_send` never talks to those apps and **does not count**. Contacts creates and deletes a throwaway person in-script. Calendar lists calendars only (no leftover events).
+This is a real Apple Events pass: Mail uses `make new outgoing message` (compose then discard; nothing is sent). Messages enumerates accounts (nothing is sent). `dry_run` of `mail_send` / `messages_send` never talks to those apps and **does not count**. Contacts creates and deletes a throwaway person in-script. Calendar lists calendars only (no leftover events). System Events is probed with **process / GUI scripting** (`tell process` + `unix id` of System Events; nothing is typed) so the keystroke compose path can pop **Allow** and verify a real Automation grant. A soft `tell application "System Events" to get name` is **not** enough — that can succeed while TCC still has node → System Events **denied**. If a prior **Don't Allow** left a sticky Deny, `permissions` reports System Events **missing** and exits non-zero: turn **System Events** on for that node in System Settings → Privacy & Security → **Automation**, then **re-run `apple-tools-mcp permissions` after Allow**.
 
-**One-pass first-run:** Allow **`node`** to control **Mail**, **Messages**, **Contacts**, and **Calendar** in the same Automation pass. Contacts or Calendar being allowed does **not** grant Mail or Messages — they are separate Apple Events targets. A denied Mail grant hangs `mail_send` / `mail_draft` / `mail_reply` / `mail_forward` until the client disconnects; `dry_run` never talks to Mail, so that deny is invisible until a real compose.
+**One-pass first-run:** Allow **`node`** to control **Mail**, **Messages**, **Contacts**, **Calendar**, and **System Events** in the same Automation pass. Contacts or Calendar being allowed does **not** grant Mail, Messages, or System Events — they are separate Apple Events targets. A denied Mail grant hangs `mail_send` / `mail_draft` / `mail_reply` / `mail_forward` until the client disconnects; `dry_run` never talks to Mail, so that deny is invisible until a real compose.
 
 **Do not add `node` via the + button in System Settings → Privacy & Security → Contacts or Calendars.** On current macOS those panes often have **no Add button**, and that instruction is not the ship-gate setup — it failed on the Mini.
 
@@ -466,7 +466,7 @@ Two arguments are available on **every** write tool:
 
 **Compose is not quoted.** `mail_send` / `mail_draft` (plain and html) call `make new outgoing message` **without** AppleScript `content:` so `newMessage` is a real Mail object, then type the body into the compose window (System Events keystrokes). Mail's `mailto` command was shipped in 2.0.4 and **fails on Mini/MacBook Mail**: it does not return an outgoing message (`newMessage` undefined, AppleScript **-2753**). On current Mail (Ventura+, FB11734014) `content` / `html content` store the body as a citation: every plain-text line prefixed with `>`, plus a `multipart/alternative` HTML part wrapped in `<blockquote type="cite">`. Desktop Mail often hides the bar with inline styles; iOS Mail paints the whole body purple with a left quote bar — even when the subject is not `Re:`/`Fwd:` and there is no `In-Reply-To`. Reply and forward still quote the original, which is expected (those paths still prepend via `content`; fixing reply/forward cite-wrap is out of scope for 2.1.0).
 
-Keystrokes use System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) **and** Automation → Mail. On Mini, the LaunchAgent's node also needs **Automation → System Events** if writes run through the write bridge. An Accessibility / System Events deny is not a Mail Automation deny (`-1743` / `-10004`).
+Keystrokes use System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) **and** Automation → Mail **and** Automation → System Events. Run `apple-tools-mcp permissions` after first install or upgrade so **node → System Events** pops **Allow** in the same sitting as Mail / Messages / Contacts / Calendar. An Accessibility / System Events deny is not a Mail Automation deny (`-1743` / `-10004`).
 
 **Compose body focus (2.0.8).** After `make new outgoing message`, To and Subject are AppleScript properties (never paste). Cmd-V used to run only after an AX window walker left the header. Quote-prefix Sent prove and Sent/Outbox verify stay gated on fail-closed body/header checks — a MacBook 2.0.7 live `mail_send` with Accessibility allowed still hit `BODY_PASTE_MISDIRECTED` when Cmd-V landed in To/Subject (`ATP-207-SENT-PROVE-20260921-084048`).
 
@@ -474,11 +474,13 @@ Keystrokes use System Events, so **node needs Accessibility** (Privacy & Securit
 
 **AppleScript reserved identifiers (2.0.10).** Dual-host Sent prove on `@2.0.9` compiled past the focused-UI fix, then failed in `atmFocusMailBody`: `set {tw, th} to size of atmElem` → **-2741** Expected expression but found `th` (AppleScript reserved ordinal).
 
-**Keystroke compose (2.1.0).** macOS 26 System Events reports `windows of process Mail = 0`, so the AX window walker cannot focus a tall `AXWebArea`. Fresh compose now **Tabs into the body** (runtime calibration against Mail `content of` the outgoing message, max Tab×6 as proven on Mini) and **types the body with Return between paragraphs**. Clipboard Cmd-V is only a fallback if the body needle is still missing. Fail-closed: missing needle or changed To/Cc/Bcc/subject is `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`; the outgoing message is deleted and nothing is sent. Apple events are wrapped in `with timeout`; hung `osascript` is **SIGKILL**'d so a wedge fails fast instead of sitting ~60s. If the Mini write-bridge / indexer daemon cannot drive System Events, `mail_send` returns `unsupported: true` so the stdio client falls back **in-process** — it does **not** hang with `MAIL_SEND_TIMEOUT_GUIDANCE` for a message that never sent.
+**Keystroke compose (2.1.0).** macOS 26 System Events reports `windows of process Mail = 0`, so the AX window walker cannot focus a tall `AXWebArea`. Fresh compose **Tabs into the body** (max Tab×6 as proven on Mini) and **types the body with Return between paragraphs**. Clipboard Cmd-V is only a fallback if a *readable* AX value is still missing the body needle. Fail-closed: missing AX body focus or changed To/Cc/Bcc/subject is `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`; the outgoing message is deleted and nothing is sent. Apple events are wrapped in `with timeout`; hung `osascript` is **SIGKILL**'d so a wedge fails fast instead of sitting ~60s. If the Mini write-bridge / indexer daemon cannot drive System Events, `mail_send` returns `unsupported: true` so the stdio client falls back **in-process** — it does **not** hang with `MAIL_SEND_TIMEOUT_GUIDANCE` for a message that never sent.
+
+**AX body-focus oracle (2.1.1).** Dual-host Mail 16 / macOS 26 showed that Mail AppleScript `content of` the outgoing message is **not** a live oracle for UI-typed/pasted text: `set content` reads back, but after Tab + keystroke/paste into the UI body `content of` stays empty (`typedSeen=false`, bodyLen 0) even when typing still produces a plain Sent `.emlx`. `@2.1.0` calibrated Tab against that property and fail-closed with `BODY_FOCUS_FAILED`. 2.1.1 Tabs until the focused AX role is a body field (`AXWebArea` / non-header `AXTextArea` via `AXFocusedUIElement` / `first UI element whose focused is true` — never `focused UI element`, never `windows of process Mail`). Cmd-V runs only when that AX **value** is readable and still missing the needle. An empty AX value is not a miss (Mail 16 WebArea); header checks still fail-closed. Ship prove that the body landed remains the Sent `.emlx` after send (2.0.7 To+subject verify). Do not “fix Tab count.”
 
 **mail_send success is Sent/Outbox verify (2.0.7).** AppleScript `send` returning without throw is not enough. After a real send the tool looks in **Sent** and **Outbox** and reports success only if the message is there. The success text names the delivery state (`mailbox: sent` + `delivery: sent`, or `mailbox: outbox` + `delivery: outbox` while still sending). If verify misses, the tool returns a failure (`isError`) — not success. Hang/timeout recover matches **To + subject** (and Message-ID when compose captured one). It never matches subject alone (short subjects like `test` are unsafe). `from` / account selection is out of scope; Mail's default From is used. `dry_run` / confirm-blocked writes stay `ok: false`, `planned: true`, `delivered: false`.
 
-**Manual prove (2.1.0 on the Mac host):** `mail_send` a short **multiline** plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. The caret must land in the **body** (not To/Subject): no `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`, and the intended text must be in the native body before send, with newlines preserved. Inspect each Sent `.emlx`: the text/plain part must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`). On Mini, prove the production path (write-bridge with node → System Events allowed, **or** the documented in-process fallback). That quote-prefix dual-host Sent prove is a separate bar from the 2.0.7 verify contract.
+**Manual prove (2.1.1 on the Mac host):** After `apple-tools-mcp permissions` reports System Events granted, `mail_send` a short **multiline** plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. The caret must land in the **body** (not To/Subject): no `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`. Inspect each Sent `.emlx`: the text/plain part must contain the intended text (newlines preserved) and must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`). On Mini, prove the production path (write-bridge with node → System Events allowed, **or** the documented in-process fallback). That quote-prefix dual-host Sent prove is a separate bar from the 2.0.7 verify contract.
 
 Emails are addressed by their RFC822 **Message-ID**. Pass `message_id`, or pass the `file_path` from `mail_search` / `mail_recent` and the server reads the Message-ID out of the `.emlx` headers for you. `mail_archive` moves the message to its account's Archive (or All Mail) mailbox; `mail_trash` moves it to that account's Trash.
 
@@ -599,9 +601,9 @@ Ensure Node.js has Full Disk Access (see Installation step 2).
 
 The message names which process macOS was actually asking about. Work through it in this order:
 
-1. **MacBook / Terminal (`permissions` CLI):** there is **no** always-on indexer. Re-run `apple-tools-mcp permissions` from **Terminal.app**, Allow the **printed `process.execPath`**, and check System Settings → Privacy & Security → **Automation** for that node → Contacts, Calendar, Mail, and Messages. Do **not** start `apple-tools-indexer`.
+1. **MacBook / Terminal (`permissions` CLI):** there is **no** always-on indexer. Re-run `apple-tools-mcp permissions` from **Terminal.app**, Allow the **printed `process.execPath`**, and check System Settings → Privacy & Security → **Automation** for that node → Contacts, Calendar, Mail, Messages, and System Events. Do **not** start `apple-tools-indexer`.
 2. **Mini only:** `pgrep -fl apple-tools-indexer` / `~/.apple-tools-mcp/writer.sock`. If the LaunchAgent is the product host, start it so writes run under launchd-owned node (see [Mini ship-gate](#mini-ship-gate-host-setup)).
-3. **Did you approve the Automation prompts for `node`?** Re-run `apple-tools-mcp permissions` with the product `node` (it prints `process.execPath`). Open System Settings → Privacy & Security → **Automation** and confirm **that printed node** is allowed to control **Mail**, **Messages**, Contacts, and Calendar. On Mini the LaunchAgent binary is whatever the plist / `which node` reports (`/Users/petercoates/.local/node/bin/node` is a Mini *example* only). MacBook Claude nvm is `/Users/petercoates/.nvm/versions/node/v22.21.1/bin/node`, not Homebrew. Watch the host — Allow **`node`**, not any other app. Contacts or Calendar being allowed does **not** grant Mail. A `mail_send` hang is **Automation denied**, not “Mail.app could not be reached”; `dry_run` never talks to Mail so it cannot detect this. Do **not** approve the MCP client / host app that launched a short-lived stdio server, and do **not** try to add `node` via **+** in the Contacts or Calendars privacy lists — those panes often have no Add button. `tccutil reset AppleEvents` re-arms the Automation prompt so you can Allow **`node`** again. Full Disk Access is a separate read grant; npm Trusted Publisher / tokens are unrelated.
+3. **Did you approve the Automation prompts for `node`?** Re-run `apple-tools-mcp permissions` with the product `node` (it prints `process.execPath`). Open System Settings → Privacy & Security → **Automation** and confirm **that printed node** is allowed to control **Mail**, **Messages**, Contacts, Calendar, and **System Events**. A prior **Don't Allow** for System Events is a sticky Deny — the Allow dialog will not appear again; turn **System Events** on for that node, then re-run `permissions` (it must not report granted from a soft name check). On Mini the LaunchAgent binary is whatever the plist / `which node` reports (`/Users/petercoates/.local/node/bin/node` is a Mini *example* only). MacBook Claude nvm is `/Users/petercoates/.nvm/versions/node/v22.21.1/bin/node`, not Homebrew. Watch the host — Allow **`node`**, not any other app. Contacts or Calendar being allowed does **not** grant Mail. A `mail_send` hang is **Automation denied**, not “Mail.app could not be reached”; `dry_run` never talks to Mail so it cannot detect this. Do **not** approve the MCP client / host app that launched a short-lived stdio server, and do **not** try to add `node` via **+** in the Contacts or Calendars privacy lists — those panes often have no Add button. `tccutil reset AppleEvents` re-arms the Automation prompt so you can Allow **`node`** again. Full Disk Access is a separate read grant; npm Trusted Publisher / tokens are unrelated.
 4. **Mini: is the daemon's node binary the one with Full Disk Access?** LaunchAgents do not inherit your shell `PATH`; confirm the plist points at the same path `which node` reports.
 5. **Is it actually the write path?** Contacts or Calendar *reads* failing with `EPERM` is a Full Disk Access / attribution problem, not the entitlement gap — fix FDA for the responsible process. Contacts or Calendar *CRUD* failing with no prompt under Claude Desktop is the [documented host limitation](#reads-and-writes-are-different-mechanisms): Claude.app carries neither the addressbook nor the calendars entitlement. On Mini, start the daemon so the write goes through the bridge. On MacBook, use Terminal.app + the printed node.
 6. **"Contacts.app / Calendar.app could not be reached"** with the app clearly installed is an **Automation / responsible-process** failure, not a missing app — macOS reports a refused Apple event as `-1728` / "can't get application". On MacBook / Terminal, Allow the printed `process.execPath`. On Mini, the write bridge / LaunchAgent may apply. A Contacts `-600` / “application isn't running” is a **cold launch**, not Automation — keep Contacts, Mail, and Messages running; Calendar does not need to stay open.

package/lib/appleScript.js

@@ -345,15 +345,19 @@ export const MAIL_ACCESSIBILITY_GUIDANCE =
   "This is not a Mail Automation deny (-1743 / -10004).";
 
 /**
- * System Events Apple Events / GUI scripting is missing, so the keystroke
- * compose path cannot run. Distinct from a Mail send hang: nothing was typed
- * or sent. Mini write-bridge should return unsupported so stdio falls back
- * in-process rather than wedging ~60s.
+ * Sticky Don't Allow for node → System Events: the Allow dialog will not
+ * reappear. Operators must flip the Automation row and re-run permissions.
  */
+export const SYSTEM_EVENTS_STICKY_DENY_GUIDANCE =
+  "A prior Don't Allow for node → System Events is a sticky Deny: the Allow dialog will not appear again. " +
+  "Turn System Events on for this node in System Settings → Privacy & Security → Automation, then re-run apple-tools-mcp permissions after Allow.";
+
+/** System Events GUI scripting missing — not a Mail send hang. */
 export const MAIL_GUI_SCRIPTING_GUIDANCE =
   "System Events GUI scripting is unavailable for this process, so the body cannot be typed into Mail. " +
   "mail_send / mail_draft use System Events keystrokes (Tab into the body, typed Returns) so Mail does not cite-wrap the Sent body (FB11734014). " +
-  "On a Mini LaunchAgent / write-bridge host, Allow the daemon's node → System Events in System Settings → Privacy & Security → Automation (in addition to node → Mail) and keep Accessibility allowed. " +
+  "Allow node → System Events in System Settings → Privacy & Security → Automation (run apple-tools-mcp permissions after install/upgrade) in addition to node → Mail, and keep Accessibility allowed. " +
+  SYSTEM_EVENTS_STICKY_DENY_GUIDANCE + " " +
   "This is not a Mail send timeout and not a Mail Automation deny (-1743 / -10004).";
 
 /**

package/lib/mailWrite.js

@@ -160,14 +160,16 @@ export const BODY_PASTE_MISDIRECTED_SENTINEL = "BODY_PASTE_MISDIRECTED";
 export const BODY_FOCUS_FAILED_SENTINEL = "BODY_FOCUS_FAILED";
 export const GUI_SCRIPTING_UNAVAILABLE_SENTINEL = "GUI_SCRIPTING_UNAVAILABLE";
 export const SYSTEM_EVENTS_PROBE_MARKER = "ATM_SYSTEM_EVENTS_PROBE";
-/** Compose body AX height vs To/Subject/Cc fields (those are ~22px). Kept for 2.0.8–2.0.10 compile tests; 2.1.0 compose does not walk AX. */
+/** Permissions-only marker: process / GUI scripting, not application `name`. */
+export const SYSTEM_EVENTS_AUTOMATION_PROBE_MARKER = "ATM_SYSTEM_EVENTS_AUTOMATION_PROBE";
+/** Compose body AX height vs To/Subject/Cc fields (those are ~22px). Used to reject short header AXTextAreas after Tab; does not walk windows. */
 export const MAIL_BODY_MIN_AX_HEIGHT = 50;
 /** Mini-proven Tab count from default compose focus into the body. */
 export const MAIL_BODY_TAB_MAX = 6;
-/** Distinctive character typed then deleted to see whether the caret is in the body. */
-export const MAIL_BODY_CALIBRATE_PROBE = "§";
-/** Cheap System Events Automation probe; SIGKILL if it still hangs. */
+/** Cheap pre-compose System Events check; SIGKILL if it still hangs. Not the permissions grant. */
 export const MAIL_SE_PROBE_TIMEOUT_MS = 4000;
+/** First-run / upgrade permissions probe: long enough for the Allow click. */
+export const SYSTEM_EVENTS_AUTOMATION_PROBE_TIMEOUT_MS = 30000;
 /** Compose osascript budget (make + keystroke + send). Far below the ~60s SE wedge. */
 export const MAIL_COMPOSE_TIMEOUT_MS = 25000;
 export const MAIL_SE_APPLEEVENT_TIMEOUT_SEC = 8;
@@ -250,6 +252,11 @@ export function isSystemEventsProbeScript(script) {
   return String(script || "").includes(SYSTEM_EVENTS_PROBE_MARKER);
 }
 
+export function isSystemEventsAutomationProbeScript(script) {
+  return String(script || "").includes(SYSTEM_EVENTS_AUTOMATION_PROBE_MARKER);
+}
+
+/** Cheap pre-compose check. Do not use for `permissions` — `get name` can soft-pass. */
 export function buildSystemEventsProbeScript() {
   const secs = asInteger(MAIL_SE_PROBE_APPLEEVENT_TIMEOUT_SEC, {
     min: 1,
@@ -268,27 +275,153 @@ if atmUi is false then error "${ACCESSIBILITY_DENIED_SENTINEL}"
 return "OK"`;
 }
 
-export function probeSystemEventsGui() {
+export function probeSystemEventsGui({ timeout = MAIL_SE_PROBE_TIMEOUT_MS } = {}) {
   return runAppleScript(buildSystemEventsProbeScript(), {
-    timeout: MAIL_SE_PROBE_TIMEOUT_MS
+    timeout
   });
 }
 
+/**
+ * First-run / upgrade probe. Soft `tell application "System Events" to get
+ * name` is not enough — Mini @2.1.1 reported granted while TCC auth_value=0
+ * for node → com.apple.systemevents. Process / GUI scripting (`tell process`)
+ * is the grant mail_send actually needs. Does not type into the focused UI.
+ * Timeout is long enough for the operator to click Allow. No short inner
+ * AppleEvent timeout (same as the Mail compose-and-discard probe).
+ */
+export function buildSystemEventsAutomationProbeScript() {
+  return `-- ${SYSTEM_EVENTS_AUTOMATION_PROBE_MARKER}
+tell application "System Events"
+  tell process "System Events"
+    set atmPid to unix id
+    set atmShown to name
+    if atmShown is "" then error "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}"
+    if atmPid is missing value then error "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}"
+    if (atmPid as integer) is less than or equal to 0 then error "${GUI_SCRIPTING_UNAVAILABLE_SENTINEL}"
+    count of UI elements
+  end tell
+  set atmUi to UI elements enabled
+end tell
+if atmUi is false then error "${ACCESSIBILITY_DENIED_SENTINEL}"
+return "OK"`;
+}
+
+/**
+ * First-run / upgrade probe: a live System Events GUI-scripting Apple Event
+ * that creates or verifies Automation → System Events. Does not type.
+ * @returns {{ ok: boolean, message: string, kind: string|null }}
+ */
+export function probeSystemEventsAutomation() {
+  const action = "system_events_automation_probe";
+  const summary = "verify System Events process / GUI scripting (Automation / Apple Events grant; nothing is typed)";
+  const result = runAppleScript(buildSystemEventsAutomationProbeScript(), {
+    timeout: SYSTEM_EVENTS_AUTOMATION_PROBE_TIMEOUT_MS
+  });
+  if (!result.ok) {
+    const kind = systemEventsGrantKind(result);
+    const guidance = isMailAccessibilityDenial(result)
+      ? MAIL_ACCESSIBILITY_GUIDANCE
+      : MAIL_GUI_SCRIPTING_GUIDANCE;
+    return {
+      ok: false,
+      kind,
+      message: `${action} failed — attempted to ${summary}. ${guidance}`
+    };
+  }
+  return {
+    ok: true,
+    kind: null,
+    message: writeSuccessMessage(
+      action,
+      "System Events Automation allowed (process GUI scripting verified; nothing was typed)"
+    )
+  };
+}
+
+function systemEventsGrantKind(result) {
+  if (!result) return "unknown";
+  if (result.kind === "timeout" || result.kind === "tcc" || result.kind === "attribution") {
+    return result.kind;
+  }
+  if (isMailGuiScriptingUnavailable(result) || isMailAccessibilityDenial(result)) {
+    return "tcc";
+  }
+  return result.kind || "unknown";
+}
+
 /**
  * AppleScript handlers: Tab into the compose body and type it (typed Returns
  * preserve newlines). Does not walk System Events `windows of process Mail`
- * (macOS 26 reports 0). Calibration reads Mail `content of` the outgoing
- * message — never `set content` / `html content` (FB11734014 cite-wrap).
+ * (macOS 26 reports 0). Calibration / verify uses the focused AX role (and
+ * AX value when it is readable) — never live Mail `content of` the outgoing
+ * message. Dual-host Mail 16 / macOS 26: `set content` reads back via
+ * `content of`, but Tab + keystroke/paste into the UI body never appears in
+ * `content of` (`typedSeen=false`, bodyLen 0) even when typing still produces
+ * a plain Sent `.emlx`. Never `set content` / `html content` (FB11734014).
  *
- * Tab count is effect-calibrated up to MAIL_BODY_TAB_MAX (Mini-proven 6).
- * Fail-closed if the body needle is missing after type (Cmd-V fallback) and
- * header checks. System Events Apple events are wrapped in `with timeout`.
+ * Tab count is unchanged (MAIL_BODY_TAB_MAX, Mini-proven 6). Fail-closed if
+ * AX focus is not a body role after Tab. Cmd-V only if AX value is readable
+ * and the needle is still missing. Header checks stay. System Events Apple
+ * events are wrapped in `with timeout`.
  */
 export function buildMailBodyPasteHandler() {
   const tabMax = asInteger(MAIL_BODY_TAB_MAX, { min: 1, max: 12, field: "tabMax" });
   const seSecs = asInteger(MAIL_SE_APPLEEVENT_TIMEOUT_SEC, { min: 1, max: 30, field: "seTimeout" });
-  const probe = asString(MAIL_BODY_CALIBRATE_PROBE);
-  return `on atmSplitParagraphs(bodyText)
+  const bodyMinH = asInteger(MAIL_BODY_MIN_AX_HEIGHT, { min: 1, max: 500, field: "bodyMinHeight" });
+  return `${buildAtmFocusedElementHandler()}
+
+on atmSafeToPaste()
+  tell application "System Events"
+    tell process "Mail"
+      try
+        set fe to my atmFocusedElement()
+        if fe is missing value then return false
+        set r to (role of fe) as string
+        if r is "AXWindow" then return false
+        if r is "AXTextField" then return false
+        if r is "AXComboBox" then return false
+        if r is "AXButton" then return false
+        if r is "AXMenuButton" then return false
+        if r is "AXPopUpButton" then return false
+        set atmH to 0
+        try
+          set {atmW, atmH} to size of fe
+        end try
+        if r is "AXTextArea" and atmH > 0 and atmH < ${bodyMinH} then return false
+        ignoring case
+          set bits to ""
+          try
+            set bits to bits & (description of fe as string) & " "
+          end try
+          try
+            set bits to bits & (name of fe as string) & " "
+          end try
+          if bits contains "To:" then return false
+          if bits contains "Cc:" then return false
+          if bits contains "Bcc:" then return false
+          if bits contains "Subject" then return false
+        end ignoring
+        if r is "AXWebArea" then return true
+        if r is "AXTextArea" then return true
+        if atmH >= ${bodyMinH} then return true
+      end try
+      return false
+    end tell
+  end tell
+end atmSafeToPaste
+
+on atmAxFocusedValue()
+  tell application "System Events"
+    try
+      set fe to my atmFocusedElement()
+      if fe is missing value then return ""
+      return value of fe as string
+    end try
+  end tell
+  return ""
+end atmAxFocusedValue
+
+on atmSplitParagraphs(bodyText)
   set atmSavedDelim to AppleScript's text item delimiters
   set AppleScript's text item delimiters to return
   set atmCrParts to text items of bodyText
@@ -326,16 +459,6 @@ on atmKeystrokeText(atmText)
   end tell
 end atmKeystrokeText
 
-on atmMailBodyContains(msg, needle)
-  tell application "Mail"
-    try
-      set atmGot to content of msg as string
-      if atmGot contains needle then return true
-    end try
-  end tell
-  return false
-end atmMailBodyContains
-
 on atmTabIntoMailBody(msg)
   tell application "Mail" to activate
   delay 0.25
@@ -346,23 +469,7 @@ on atmTabIntoMailBody(msg)
   end timeout
   delay 0.08
   repeat with atmN from 0 to ${tabMax}
-    with timeout of ${seSecs} seconds
-      tell application "System Events"
-        tell process "Mail"
-          keystroke ${probe}
-        end tell
-      end tell
-    end timeout
-    delay 0.08
-    set atmHit to my atmMailBodyContains(msg, ${probe})
-    with timeout of ${seSecs} seconds
-      tell application "System Events"
-        tell process "Mail"
-          key code 51
-        end tell
-      end tell
-    end timeout
-    if atmHit then return
+    if my atmSafeToPaste() then return
     if atmN is ${tabMax} then error "${BODY_FOCUS_FAILED_SENTINEL}"
     with timeout of ${seSecs} seconds
       tell application "System Events"
@@ -423,11 +530,15 @@ end atmPasteMailBodyFallback
 on atmFillMailBody(bodyText, needle, msg)
   try
     atmTabIntoMailBody(msg)
+    if my atmSafeToPaste() is false then error "${BODY_FOCUS_FAILED_SENTINEL}"
     atmTypeMailBody(bodyText)
     delay 0.12
     if needle is not "" then
-      if my atmMailBodyContains(msg, needle) is false then
-        atmPasteMailBodyFallback(bodyText)
+      set atmAxVal to my atmAxFocusedValue()
+      if atmAxVal is not "" then
+        if atmAxVal does not contain needle then
+          atmPasteMailBodyFallback(bodyText)
+        end if
       end if
     end if
   on error errMsg number errNum
@@ -457,20 +568,10 @@ function composeMisdirectChecks({ to, cc = [], bcc = [], subject, body }) {
     })
     .join("\n");
   const bodyCheck = needle
-    ? `    set atmGotBody to ""
-    try
-      set atmGotBody to content of newMessage as string
-    end try
-    if atmGotBody is "" then
-      try
-        save newMessage
-      end try
-      delay 0.2
-      try
-        set atmGotBody to content of newMessage as string
-      end try
-    end if
-    if atmGotBody does not contain ${asString(needle)} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"`
+    ? `    set atmAxVal to my atmAxFocusedValue()
+    if atmAxVal is not "" then
+      if atmAxVal does not contain ${asString(needle)} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
+    end if`
     : "";
   return `    if (count of to recipients of newMessage) is not ${toCount} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
     if (count of cc recipients of newMessage) is not ${ccCount} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
@@ -490,10 +591,13 @@ ${bodyCheck}`;
  * Do not set AppleScript `content` or `html content`: Ventura+ FB11734014
  * cite-wraps those setters (`>` prefixes + `<blockquote type="cite">`).
  * Recipients and subject are AppleScript properties (never paste). The body
- * is typed into the native compose editor via System Events (Tab into body,
- * typed Returns for newlines, Cmd-V only if the body needle is still
- * missing). Do not walk `windows of process Mail`. If the body never
- * receives the intended text, or headers change, abort + delete (nothing sent).
+ * is typed into the native compose editor via System Events (Tab into body
+ * until AX focused role is a body field, typed Returns for newlines, Cmd-V
+ * only if AX value is readable and the needle is still missing). Do not walk
+ * `windows of process Mail`. Do not use Mail `content of` as the oracle that
+ * typed/pasted text landed (Mail 16 / macOS 26: that property stays empty).
+ * If AX body focus cannot be established, or headers change, abort + delete
+ * (nothing sent). Ship prove that the body landed is Sent `.emlx` after send.
  */
 export function buildComposeScript({ to, cc, bcc, subject, body, send, html = false }) {
   const recipients = [

package/lib/permissions.js

@@ -1,27 +1,29 @@
 /**
  * First-run / upgrade permissions command.
  *
- * Probes Contacts, Calendar, Mail, and Messages under process.execPath so
- * macOS can pop Allow dialogs for that node binary. The user clicks Allow;
- * this command cannot grant silently.
+ * Probes Contacts, Calendar, Mail, Messages, and System Events under
+ * process.execPath so macOS can pop Allow dialogs for that node binary.
+ * The user clicks Allow; this command cannot grant silently.
  *
  * Always runs in this process (never via the write bridge): the point is to
  * attach the dialogs to process.execPath. If the invoked CLI / shebang
  * points at a different node, print a WARN — Allows attach to execPath.
  * Mail and Messages use the existing live Apple Events helpers — dry_run of
  * mail_send / messages_send never talks to those apps and does not count.
+ * System Events uses process / GUI scripting (`tell process`), not a soft
+ * application `get name` — that can succeed without AppleEvents auth.
  */
 
 import fs from "fs";
 import path from "path";
-import { classifyAppleScriptError } from "./appleScript.js";
-import { probeMailAutomation } from "./mailWrite.js";
+import { classifyAppleScriptError, SYSTEM_EVENTS_STICKY_DENY_GUIDANCE } from "./appleScript.js";
+import { probeMailAutomation, probeSystemEventsAutomation } from "./mailWrite.js";
 import { probeMessagesAutomation } from "./messagesWrite.js";
 import { probeContactsAutomation } from "./contactsWrite.js";
 import { probeCalendarAutomation } from "./calendarWrite.js";
 import { detectLaunchAgentContext, hostAutomationAdvice } from "./writeRouting.js";
 
-export const REQUIRED_SURFACES = ["Contacts", "Calendar", "Mail", "Messages"];
+export const REQUIRED_SURFACES = ["Contacts", "Calendar", "Mail", "Messages", "System Events"];
 
 /** Mini ship-gate host example — not a universal path. */
 export const EXAMPLE_MINI_NODE = "/Users/petercoates/.local/node/bin/node";
@@ -172,6 +174,9 @@ export function classifyGrantStatus(result) {
   if (kind === "app_not_running") {
     return GRANT_ERROR;
   }
+  if (/accessibility_denied|assistive access|gui_scripting_unavailable/i.test(text)) {
+    return GRANT_MISSING;
+  }
   if (/tcc|automation deny|not authorized|not permitted|not allowed|timed out|etimedout|responsible-process|attribution/i.test(text)) {
     return GRANT_MISSING;
   }
@@ -198,7 +203,7 @@ export function exitCodeForGrants(grants) {
 
 /**
  * Advisory Full Disk Access touch. Read tools need FDA on this node; it is
- * not one of the four required Automation grants and never fails the command.
+ * not one of the required Automation grants and never fails the command.
  *
  * @returns {{ status: "readable"|"missing"|"skipped", message: string }}
  */
@@ -247,7 +252,8 @@ export function defaultPermissionsProbes() {
     Contacts: probeContactsAutomation,
     Calendar: probeCalendarAutomation,
     Mail: probeMailAutomation,
-    Messages: probeMessagesAutomation
+    Messages: probeMessagesAutomation,
+    "System Events": probeSystemEventsAutomation
   };
 }
 
@@ -267,12 +273,15 @@ function bannerLines(binary, version) {
     "dry_run of mail_send / messages_send does not count: this command uses real Apple Events.",
     "Nothing is sent to third parties. Mail composes and discards a temporary outgoing message.",
     "Messages only enumerates accounts. Contacts creates and deletes a throwaway person in-script.",
-    "Calendar lists calendars only — no events are created."
+    "Calendar lists calendars only — no events are created.",
+    "System Events is probed with process / GUI scripting (tell process + unix id; nothing is typed).",
+    "A soft tell System Events to get name is not enough — that can succeed without AppleEvents auth.",
+    "A prior Don't Allow is a sticky Deny: turn System Events on for this node in Automation, then re-run this command."
   ];
 }
 
 /**
- * Run the four live probes and print a grant report.
+ * Run the live Automation probes and print a grant report.
  *
  * @param {object} [options]
  * @param {string} [options.execPath]
@@ -349,11 +358,14 @@ export async function runPermissionsCommand({
 
   const code = exitCodeForGrants(grants);
   if (code === 0) {
-    log("Result: PASS — Contacts, Calendar, Mail, and Messages are granted for this node.");
+    log("Result: PASS — Contacts, Calendar, Mail, Messages, and System Events are granted for this node.");
     log("Safe to re-run; already-granted surfaces report OK without another click.");
   } else {
     log("Result: INCOMPLETE — one or more required grants are missing or errored.");
     log(hostAdvice);
+    if (grants["System Events"] !== GRANT_GRANTED) {
+      log(SYSTEM_EVENTS_STICKY_DENY_GUIDANCE);
+    }
     log("Click Allow for the missing surfaces and re-run this command. Exit is non-zero (fail closed).");
   }
   return code;

package/lib/writeRouting.js

@@ -91,7 +91,7 @@ export function terminalAutomationAdvice(execPath = process.execPath) {
   return (
     `Run this from Terminal.app (short-lived CLI / MacBook host — no always-on indexer). ` +
     `Click Allow for the printed process.execPath${printed}. ` +
-    `Check System Settings → Privacy & Security → Automation for that node → Contacts, Calendar, Mail, and Messages. ` +
+    `Check System Settings → Privacy & Security → Automation for that node → Contacts, Calendar, Mail, Messages, and System Events. ` +
     `Do not start apple-tools-indexer.`
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-tools-mcp",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "MCP server for semantic search and write actions across Apple Mail, Messages, Calendar, and Contacts",
   "type": "module",
   "main": "index.js",